• Security Disclosure: Bitcoin Core node software maintainers disclosed three vulnerabilities reported during 2025 and patched in October 2025.
  • Mining Risk: A high-severity flaw caused mempool inconsistencies when transactions were removed without also clearing their descendants.
  • Network Impact: Two medium-severity flaws concerned delays in block processing and unintended whitelist permissions for some Tor connections.

Bitcoin Core publicly disclosed three previously patched security vulnerabilities, including a high-severity flaw that could stop some mining nodes from creating valid block templates. The issues were originally reported during 2025, and fixes were released in October of that year. The protocol said the vulnerabilities differed in severity, but each could have operational consequences for node operators and miners.

High-Severity Bug Caused Mempool Inconsistencies

The most serious issue, tracked as CVE-2025-62861, affected Bitcoin Core versions 28.0 through 28.2 and 29.0 through 29.1. Niklas Goegge reported the vulnerability on Sept. 26, 2025. Bitcoin Core said transaction-handling rules continued to apply after certain transactions returned to the mempool following a chain reorganization.

As a result, a transaction could be removed without also removing its descendants, leaving the mempool in an inconsistent state. For miners, the consequences were significant. Affected nodes had to be restarted before they could again generate valid block templates, making the flaw particularly relevant to mining operations that depend on uninterrupted node performance.

Two More Medium-Severity Vulnerabilities

A second vulnerability reported against Bitcoin Core in April 2025 was identified as CVE-2025-62859. Researcher Eugene Siegel found that a malicious peer could use witness malleation in compact blocks to delay block processing by up to 10 minutes. The advisory released by Bitcoin Core noted that the attack could be repeated indefinitely against nodes operating in “-blocksonly” mode or when the attacker controlled all three high-bandwidth peers.

Tor Whitelisting Issue Also Addressed

The third bug disclosed by Bitcoin Core, CVE-2025-62860, involved nodes using the optional “-whitelist” setting. With certain configurations, incoming Tor peers could be granted whitelist permissions if the proxy’s IP address was within an approved range. Bitcoin Core said thousands of reachable mainnet nodes had been whitelisting incoming Tor connections, weakening some denial-of-service protections and privacy safeguards.

Nodes not using the non-default whitelist setting were unaffected. Bitcoin Core 30.0 included fixes for all three vulnerabilities on Oct. 10, 2025, followed by version 29.2 on Oct. 14. According to the advisories, the last vulnerable Bitcoin Core release reached end of life on Oct. 27.